OBF, short for on-behalf-of, is Zoom's model for letting a bot join a meeting as an automated participant.
The bot acts on behalf of one user who has authorised your Zoom Marketplace app.
Each end user consents once.
After that your app can mint short-lived OBF tokens to join meetings for that user.
Tokens last about two hours each, one per SDK session.
Zoom has required OBF since 2 March 2026 for Meeting SDK bots joining meetings hosted outside the app's own account.
An OBF token is scoped to joining meetings as an automated participant.
Why OBF exists
Before OBF, bots joined with a Zoom Access Key.
Your integration fetched that per-user token through Zoom's API and handed it to the SDK.
OBF replaces it with a connection each end user authorises once, in Zoom's own consent screen.
Zoom can audit that connection, and either side can revoke it.
How the flow works on MeetStream
You register one Zoom OAuth app. Each end user then walks this path once.
Creating a bot then names the user it is acting for:
{
"meeting_link": "https://zoom.us/j/123456789?pwd=…",
"bot_name": "Notetaker",
"zoom": { "use_zoom_obf": true,
"zoom_oauth_connection_user_id": "<zoom_user_id>" }
}Your app asks for two read scopes on the user profile and token.
You list and revoke connections through the same API.
MeetStream keeps all token material server side.
The Zoom integration page covers setup end to end.
The one value to double-check
The redirect URL matches byte for byte in three places.
Matching it exactly is the one step worth double-checking.
Why does Zoom ask a user to reconnect?
A connection stays live while the user keeps their Zoom password and the app installed, and uses it inside 90 days.
Past any of those, the create call returns a disconnected-user response and one fresh consent restores it.
Host your callback on a deployed HTTPS endpoint so Zoom can reach it. The OBF implementation guide has the full sequence.
Frequently asked questions
Is OBF mandatory?
For Meeting SDK bots joining meetings hosted outside your own Zoom account, yes, since 2 March 2026.
MeetStream handles the token exchange; you handle the one-time user consent.
What is the difference between OBF and ZAK?
A ZAK is a per-user credential your app fetches; OBF is a per-user consent the person grants, which Zoom can audit and either side can revoke.
Does the user have to be in the meeting?
Yes. Zoom issues OBF tokens only for participants who have authorised the app and are present in the meeting.
Can one Zoom app serve many customers?
Yes. Publish one app on the Marketplace. Each customer's users authorise it separately.
Put the vocabulary to work
One API to join, record, stream and transcribe meetings across Zoom, Google Meet and Microsoft Teams.